Question 1

Which action does the Shared Insight Cache (SIC) server take when the whitelist reaches maximum capacity?
A) The SIC server allocates additional memory for the whitelist as needed.
B) The SIC server will remove items with the fewest number of votes.
C) The SIC server will remove the least recently used items based on the prune size.
D) The SIC server will start writing the cache to disk.

Accepted Answer

The SIC server manages the whitelist by removing the least recently used items based on the prune size when it reaches maximum capacity.

Question 2

Which policy should an administrator modify to enable Virtual Image Exception (VIE) functionality?
A) Host Integrity Policy
B) Exceptions Policy
C) Virus and Spyware Protection Policy
D) Application and Device Control Policy

Accepted Answer

The Virtual Image Exception (VIE) functionality is typically part of the Virus and Spyware Protection Policy, which deals with scanning and exceptions for virtual environments.

Question 3

A Symantec Endpoint Protection (SEP) client uses a management server list with three management servers in the priority 1 list. Which mechanism does the SEP client use to select an alternate management server if the currently selected management server is unavailable?
A) The client chooses the next server alphabetically by server name.
B) The client chooses another server alphabetically in the list randomly.
C) The client chooses a server with the next highest IP address.
D) The client chooses a server based on the lowest server load.

Accepted Answer

The answer of A Symantec Endpoint Protection (SEP) client uses...

Question 4

A Symantec Endpoint Protection (SEP) administrator creates a firewall policy to block FTP traffic and assigns the policy to all of the SEP clients. The network monitoring team informs the administrator that a client system is making an FTP connection to a server. While investigating the problem from the SEP client GUI, the administrator notices that there are zero entries pertaining to FTP traffic in the SET Traffic log or Packet log. While viewing the Network Activity dialog, there is zero inbound/outbound traffic for the FTP process. What is the most likely reason?
A) The server is in the IPS policy excluded hosts list.
B) The block rule is below the blue line.
C) Peer-to-peer authentication is allowing the traffic.
D) The server has an IPS exception for that traffic.

Accepted Answer

The answer of A Symantec Endpoint Protection (SEP) administrator creates...

Question 5

An administrator needs to increase the access speed for client files that are stored on a file server. Which configuration should the administrator review to address the read speed from the server?
A) Enable Network Cache in the client's Virus and Spyware Protection policy
B) Add the applicable server to a trusted host group
C) Enable download randomization in the client group's communication settings
D) Create a Firewall allow rule for the server's IP address.

Accepted Answer

Enabling Network Cache in the client's Virus and Spyware Protection policy can help improve access speed by reducing the need to repeatedly scan files that have already been deemed safe, thus speeding up read operations from the server.

Question 6

Which feature reduces the impact of Auto-Protect on a virtual client guest operating system?
A) Network Shared Insight Cache
B) Scan Randomization
C) Virtual Shared Insight Cache
D) Virtual Image Exception

Accepted Answer

The answer of Which feature reduces the impact of Auto-Protect...

Question 7

Which settings can impact the Files trusted count? 
A) System Lockdown Whitelist in the Application and Device Control Policy
B) File Cache settings in the Virus and Spyware Protection policy
C) Insight settings in the Virus and Spyware Protection policy
D) SONAR settings in the Virus and Spyware Protection policy

Accepted Answer

The answer of Which settings can impact the Files trusted...

Question 8

Where in the Symantec Endpoint Protection (SEP) management console will a SEP administrator find the option to allow all users to enable and disable the client firewall?
A) Settings in Intrusion Prevention Policy
B) Overview in Firewall Policy
C) Client User Interface Control Settings
D) System Lockdown in Group Policy

Accepted Answer

The option to allow all users to enable and disable the client firewall is found in the Client User Interface Control Settings within the Symantec Endpoint Protection management console.

Question 9

In addition to performance improvements, which two benefits does Insight provide? (Select two)
A) Reputation scoring for documents.
B) False positive migration.
C) Zero-day threat detection.
D) Blocks malicious websites.
E) Protects against malicious java scripts.

Accepted Answer

The answer of In addition to performance improvements, which two...

Question 10

In the virus and Spyware Protection policy, an administrator sets the First action to Clean risk and sets If first action fails to Delete risk? Which two factors should the administrator consider? (Select two.)
A) The deleted file may still be in the Recycle Bin.
B) IT Analytics may keep a copy of the file for investigation.
C) False positives may delete legitimate files.
D) Insights may back up the file before sending it to Symantec.
E) A copy of the threat may still be in the quarantine.

Accepted Answer

False positives may lead to the deletion of legitimate files, and a copy of the threat may still be in quarantine even after deletion attempts.

Question 11

A Symantec Endpoint Protection administrator is using System Lockdown in blacklist mode with a file fingerprint list. When testing a client, the administrator notices that at least one of the files is allowed to execute. What is the likely cause of the problem?
A) The application has been upgraded.
B) The Application and Device Control policy is in the test mode.
C) A file exception has been added to the Exceptions policy.
D) The Application and Device Control policy is allowing the file to execute.

Accepted Answer

The answer of A Symantec Endpoint Protection administrator is using...

Question 12

A company plans to install six Symantec Endpoint Protection Managers (SEPMs) spread evenly across two sites. The administrator needs to direct replication activity to SEPM3 server in Site 1 and SEPM4 in Site 2. Which two actions should the administrator take to direct replication activity to SEPM3 and SEPM4? (Select two.)
A) Install the SQL Server databases on SEPM3 and SEPM4
B) Ensure SEPM3 and SEPM4 are in the same time zone
C) Ensure SEPM3 and SEPM4 are defined as remote servers in the replication partner configuration
D) Install SEPM3 and SEPM4 after the other SEPMs
E) Ensure SEPM3 and SEPM4 are defined as the top priority server in in the Site Settings

Accepted Answer

SEPM3 and SEPM4 must be defined as remote servers in the replication partner configuration and as the top priority server in the Site Settings to direct replication activity to them.

Question 13

In which two areas can host groups be used? (Select two.)
A) Locations
B) Download Insight
C) IPS
D) Application and Device Control
E) Firewall

Accepted Answer

Host groups can be used in IPS (Intrusion Prevention System) and Firewall settings to manage and apply security policies based on groups of hosts.

Question 14

Catastrophic hardware failure has occurred on a single Symantec Endpoint Protection Manager (SEPM) in an environment with two SEPMs. What is the quickest way an administrator can restore the environment to its original state?
A) Install a new SEPM into the existing site
B) Reinstall the entire SEPM environment
C) Clone the still functioning SEPM and change the server.properties file
D) Build a new site and configure replication with the still functioning SEPM

Accepted Answer

Installing a new SEPM into the existing site is the quickest way to restore the environment, as it allows the new SEPM to join the existing infrastructure and synchronize with the remaining SEPM.

Question 15

Which action does SONAR take before convicting a process?
A) Checks the reputation of the process.
B) Restarts the system.
C) Quarantines the process.
D) Blocks suspicious behavior.

Accepted Answer

SONAR checks the reputation of the process as part of its analysis before taking any action like convicting or quarantining it.

Question 16

Which Symantec Endpoint Protection defense mechanism provides protection against threats that propagate from system to system through the use of autorun.inf files?
A) Host Integrity
B) SONAR
C) Application and Device Control
D) Emulator

Accepted Answer

Application and Device Control in Symantec Endpoint Protection can block or restrict the execution of autorun.inf files, which are often used by threats to propagate across systems.

Question 17

Which setting can an administrator configure in the LiveUpdate policy?
A) Linux Settings
B) Frequency to download content.
C) Specific content revision to download from a Group Update Provider (GUP)
D) Specific content policies to download

Accepted Answer

Administrators can configure the frequency at which LiveUpdate downloads content in the LiveUpdate policy.

Question 18

Which action should an administrator take to prevent users from using Windows Security Center?
A) Set Disable antivirus alert within Windows Security Center to Disable
B) Set Disable Windows Security Center to Always
C) Set Disable Windows Security Center to Disable
D) Set Disable antivirus alert within Windows Security Center to Never

Accepted Answer

Setting "Disable Windows Security Center to Always" will prevent users from accessing or using the Windows Security Center.

Question 19

A large-scale virus attack is occurring and a notification condition is configured to send an email whenever viruses infect five computers on the network. A Symantec Endpoint Protection administrator has set a one hour damper period for that notification condition. How many notifications dos the administrator receive after 30 computers are infected in two hours?
A) 1
B) 15
C) 6
D) 2

Accepted Answer

The answer of A large-scale virus attack is occurring and...

Question 20

An administrator is re-adding an existing Replication Partner to the local Symantec Endpoint Protection Manager site. Which two parameters are required to re-establish this replication partnership? (Select two.)
A) Remote site Encryption Password
B) Remote server IP Address and port
C) Remote SQL database account credentials
D) Remote server Administrator credentials
E) Remote site Domain ID

Accepted Answer

The Remote server IP Address and port and Remote server Administrator credentials are required to re-establish this replication partnership.

Exam 2: Administration of Symantec Email Security.cloud (v1)

Which action does the Shared Insight Cache (SIC) server take when the whitelist reaches maximum capacity?

Which policy should an administrator modify to enable Virtual Image Exception (VIE) functionality?

A Symantec Endpoint Protection (SEP) client uses a management server list with three management servers in the priority 1 list. Which mechanism does the SEP client use to select an alternate management server if the currently selected management server is unavailable?

An administrator needs to increase the access speed for client files that are stored on a file server. Which configuration should the administrator review to address the read speed from the server?

Which feature reduces the impact of Auto-Protect on a virtual client guest operating system?

Which settings can impact the Files trusted count?

Where in the Symantec Endpoint Protection (SEP) management console will a SEP administrator find the option to allow all users to enable and disable the client firewall?

In addition to performance improvements, which two benefits does Insight provide? (Select two)

In the virus and Spyware Protection policy, an administrator sets the First action to Clean risk and sets If first action fails to Delete risk? Which two factors should the administrator consider? (Select two.)

A Symantec Endpoint Protection administrator is using System Lockdown in blacklist mode with a file fingerprint list. When testing a client, the administrator notices that at least one of the files is allowed to execute. What is the likely cause of the problem?

In which two areas can host groups be used? (Select two.)

Catastrophic hardware failure has occurred on a single Symantec Endpoint Protection Manager (SEPM) in an environment with two SEPMs. What is the quickest way an administrator can restore the environment to its original state?

Which action does SONAR take before convicting a process?

Which Symantec Endpoint Protection defense mechanism provides protection against threats that propagate from system to system through the use of autorun.inf files?

Which setting can an administrator configure in the LiveUpdate policy?

Which action should an administrator take to prevent users from using Windows Security Center?

An administrator is re-adding an existing Replication Partner to the local Symantec Endpoint Protection Manager site. Which two parameters are required to re-establish this replication partnership? (Select two.)